Cantinieri v. Verisk Analytics, Inc.

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF NEW YORK

--------------------------------------------------------------X

JILLIAN CANTINIERI, individually, and

on behalf of herself and all others similarly

situated,

Plaintiff,

MEMORANDUM ORDER

21-cv-6911 (NJC) (JMW)

-against-

VERISK ANALYTICS, INC., INSURANCE

SERVICES OFFICE, INC., and ISO CLAIMS

SERVICES INC.,

Defendants.

--------------------------------------------------------------X

A P P E A R A N C E S:

Anthony P. Mastroianni, Esq.

Locks Law Firm PLLC

622 Third Avenue

7th Floor

New York, NY 10017

-and-

Raymond C Silverman, Esq.

Jerrold S. Parker, Esq.

Parker Waichman LLP

6 Harbor Park Drive

Port Washington, NY 11050

Attorneys for Plaintiff

Jasmeet Ahuja, Esq.

Caitlyn Anne Mancuso, Esq.

Hogan Lovells US LLP

1735 Market Street

23rd Floor

Philadelphia, PA 19103

-and-

Allison M. Holt-Ryan, Esq.

Joseph J. Cavanaugh, Esq.

Hogan Lovells US LLP

Columbia Square

555 Thirteenth Street, NW

Washington, DC 20004

Attorneys for Defendants

WICKS, Magistrate Judge:

“It is clear that the courts of this country recognize a general right to inspect and copy

public records and documents, including judicial records and documents. In contrast to

the English practice, . . .American decisions generally do not condition enforcement of

this right on a proprietary interest in the document or upon a need for it as evidence in a

lawsuit.”1

Plaintiff, Jillian Cantinieri (“Plaintiff”), commenced this action on December 15, 2021

against Defendants Verisk Analytics, Inc., Insurance Services Office Inc., and ISO Claims

Services Inc. (collectively, “Defendants”), for negligence, negligence per se, unjust enrichment,

violations of the Information Security Breach and Notification Act, N.Y. Gen. Bus. Law § 899-

aa, and violations of New York General Business Law (“GBL”) § 349, alleging Defendants

failed to safeguard the personally identifiable information (“PII”) of Plaintiff and the members of

the proposed classes from a targeted breach of their databases (“data breach”) by unauthorized

entities or criminals. See generally ECF No. 1. Following Plaintiff’s commencement of the

action, the parties served Interrogatories and Requests for Production and associated Responses

to each other – with some of Defendants’ Responses being marked as “CONFIDENTIAL.” (ECF

No. 76 at 1.) Defendants moved to dismiss the Complaint under the Federal Rules of Civil

Procedure (“FRCP”) 12(b)(1) and 12(b)(6) on June 9, 2022 (ECF No. 26), which was denied

without prejudice by the previously assigned District Judge, the Hon. Joan M. Azrack, on March

1 Nixon v. Warner Commc’ns. Inc., 435 U.S. 589, 597 (1978).

31, 2023 (ECF No. 49), who directed the parties to conduct limited jurisdictional discovery “to

resolve the issue of Plaintiff’s Article III standing.” (ECF No. 49 at 4-5.) Judge Azrack noted

that after jurisdictional discovery was complete, Defendants “would be permitted to renew under

Rule 12(b)(1), supported by affidavits and exhibits, and Rule 12(b)(6).” (Id.) In the course of

jurisdictional discovery, Defendants produced “a number of CONFIDENTIAL” documents.

(ECF No. 76 at 2.)

On November 20, 2023, the parties agreed that jurisdictional discovery was complete (see

Electronic Order dated November 20, 2023), and Plaintiff filed an Amended Complaint on

December 15, 2023. (ECF No. 72.) Defendants served their renewed Motion to Dismiss

Plaintiff’s Amended Complaint on January 12, 2024, Plaintiff served her Opposition on February

2, 2024, and Defendants served their Reply on February 16, 2024. (ECF No. 76 at 2.) Before the

Court, on referral from the Hon. Nusrat J. Choudhury (see Electronic Order dated February 20,

2024), is the parties’ Joint MOTION for Leave to Electronically File Document under Seal

Motion to Dismiss Papers (ECF No. 76), which requests that certain exhibits attached to the

moving papers be filed under seal, and that portions of the briefing relying on such exhibits be

redacted, “because they are or rely on Interrogatory Responses, produced documents, or

deposition testimony that have been designated CONFIDENTIAL pursuant to the Parties’

Confidentiality Stipulation and Order entered in this case” by the undersigned. (ECF No. 76 at

2; ECF No. 38.)2 For the following reasons, the parties’ Joint Motion to Seal (ECF No. 76) is

GRANTED.

2 The Confidentiality Stipulation and Order in this case states that “[d]ocuments designated ‘Confidential’

shall be shown only to the attorneys, parties, experts, actual or proposed witnesses, court personnel, and

other persons necessary to review the documents for the prosecution or defense of this lawsuit. No public

disclosure of documents designated ‘Confidential’ shall be permitted unless such documents are not

deemed Confidential after either being successfully challenged or after the designating party withdraws

DISCUSSION

The parties jointly seek to file under seal certain exhibits attached to the Parties’ briefing

– and redact portions of the briefing relying on such exhibits – because these exhibits “contain

extremely sensitive confidential business information, trade secrets, and data privacy and

cybersecurity information about the security incident at issue in this case, and portions of the

[p]arties’ briefing quotes and discusses such material.” (Id.) According to the parties, this

material includes: (i) “material nonpublic information about Defendants’ security procedures and

protocols, or [personal] information about Plaintiff[,]” and “the specific ways that Defendants

collect, transmit, and store PII, as well as how Defendants became aware of the [data breach],

what information the fraudulent actors were successful in obtaining, and the security actions

Defendants took both before and following the incident.” (Id.)3 The parties agree that

“[d]isclosing this information could provide a roadmap for bad actors to circumvent the security

systems and procedures that are in place to detect and prevent fraudulent access.” (Id.)

Although the parties are moving jointly to seal these documents (ECF No. 76), and

despite the existence of a court-approved protective order allowing the parties to designate

materials as confidential and to request permission to file such documents under seal (ECF No.

38), this Court must—given the common law right of public access to judicial documents firmly

the Confidential designation.” (Id. at 2, ¶ (d).) None of the Parties’ confidentiality designations have been

challenged by the other party. (ECF No. 76 at 3.)

3 The parties specifically request to seal: “Defendants’ Responses to Plaintiff’s Interrogatories 17 (see

Mot. to Dismiss (“MTD”) at 2; MTD, Ex. 1-2; Opposition to Motion to Dismiss (“Opp’n”) at 12; Opp’n,

Ex. 5) and 22 (Opp’n at 16; Opp’n, Ex. 6), ISO Claims’ investigation report stemming from the

Security Incident (see MTD at 5; MTD, Ex. 8; Opp’n at 2, 12; Opp’n, Ex. 1; Reply at 2), excerpts

from the deposition of Mr. Michael Snook (see Opp’n at 4, 16; Opp’n, Ex. 3), and Plaintiff’s Motor

Vehicle Report (see MTD at 17; MTD, Ex. 5; Opp’n, Ex. 4).” (ECF No. 76 at 3.)

rooted in our nation’s history—ensure that the requested sealing is narrowly tailored and “is

necessary to preserve higher values” above the public’s right to transparency. Lugosch v.

Pyramid Co. of Onondaga, 435 F.3d 110, 119, 124 (2d Cir. 2006).

Within the Second Circuit, there is a three-part analysis for determining whether

documents relating to a lawsuit should be sealed. See King Pharm., Inc. v. Eon Labs, Inc., No.

04-cv-5540, 2010 WL 3924689, at *4 (E.D.N.Y. Sept. 28, 2010) (internal quotation marks and

citation omitted); Lugosch, 435 F.3d at 119. Courts must first determine whether the documents

are judicial documents, “to which the public has a presumptive right of access.” King Pharm.,

Inc., 2010 WL 3924689, at *4 (citation omitted). A judicial document is not simply a document

filed with the court, but one that is “relevant to the performance of the judicial function and

useful in the judicial process.” Lugosch, 435 F.3d at 119 (internal quotation marks and citation

omitted). A document is “relevant to the performance of the judicial function if it would

reasonably have a tendency to influence a district court’s ruling on a motion . . . without regard

to which way the court ultimately rules or whether the document ultimately in fact influences the

court’s decision.” See Brown v. Maxwell, No. 16-cv-3945, 2019 WL 2814839, at *4–5 (2d Cir.

July 3, 2019) (internal quotation marks and citation omitted) (emphasis in original).

If the documents are judicial documents, the court must then determine the weight of the

public’s presumptive right of access. King Pharm., Inc., 2010 WL 3924689, at *4 (citation

omitted). Finally, the court must balance competing considerations against the presumptive right

to access, including “the danger of impairing judicial efficiency and the privacy interests of those

resisting disclosure.” Id. (citation omitted). In so doing, courts must be cognizant that “the

presumption of public access to court documents has the potential to exacerbate . . . harms to

privacy and reputation by ensuring that damaging material irrevocably enters the public record.”

See Brown, 2019 WL 2814839, at *3. The question of whether documents are sealed is

ultimately left to the sound discretion of the district court, which should “be exercised in light of

the relevant facts and circumstances of the particular case.” Nixon v. Warner Commc’ns, Inc.,

435 U.S. 589, 599 (1978) (citations omitted).

In analyzing privacy interests as a competing consideration against the presumptive right

to access, this Circuit has clearly enunciated “that the privacy interests of innocent third parties

should weigh heavily in a court's balancing equation. Such interests, while not always fitting

comfortably under the rubric ‘privacy,’ are a venerable common law exception to the

presumption of access.” United States v. Amodeo, 71 F.3d 1044, 1050–51 (2d Cir. 1995). The

Amodeo Court articulated three factors to consider in making sealing determination based on

privacy interests. First, “courts should consider the degree to which the subject matter is

traditionally considered private rather than public. Financial records of a wholly owned business,

family affairs, illness, embarrassing conduct with no public ramifications, and similar matters

will weigh more heavily against access than conduct affecting a substantial portion of the

public.” Id. at 1051. Next, courts should consider “[t]he nature and degree of injury . . . . This

will entail consideration not only of the sensitivity of the information and the subject but also of

how the person seeking access intends to use the information.” Id. Lastly, courts should consider

the reliability of the information and err on the side of non-disclosure of unverified information.

Id.

Preliminary, “[j]ust as with documents submitted in connection with a Motion for

Summary Judgment, documents filed in connection to a Motion to Dismiss ‘are judicial

documents to which a presumption of immediate public access attaches under both the common

law and the First Amendment.’” Bernsten v. O'Reilly, 307 F. Supp. 3d 161, 166–67 (S.D.N.Y.

2018) (quoting Lugosch, 435 F.3d at 126). “Dispositive motions are adjudications, and ‘[a]n

adjudication is a formal act of government, the basis of which should, absent exceptional

circumstances, be subject to public scrutiny.’” Id. (quoting Joy v. North, 692 F.2d 880, 893 (2d

Cir. 1982)). Thus, the presumption of access exists as to the documents at issue here, which must

be overcome to warrant sealing. See Olson v. Major League Baseball, 29 F.4th 59, 89–90 (2d

Cir. 2022) (“[A] strong presumption [of public access] attaches to materials filed in connection

with dispositive motions, such as a motion to dismiss.”).

The parties contend that “the underlying rationale of the privilege [afforded to law

enforcement techniques and procedures by the Second Circuit] compels protection of

Defendants’ own techniques and procedures to deter cyber fraud and protect PII.” See ECF No.

76 at 4 (quoting United States v. Amodeo, 44 F.3d 141, 147 (2nd Cir. 1995)) (“The Second

Circuit has previously recognized the ‘law enforcement privilege as an interest worthy of

protection.’ This privilege ‘is designed to prevent disclosure of,’ among other things, ‘law

enforcement techniques and procedures.’”). The parties further contend that “[p]ublic disclosure

of Defendants’ anti-fraud practices and procedures for protecting PII could alert wrongdoers to

potential methods of avoiding them, thus undermining their efficacy . . . [and, that] [o]ther

district courts, when considering nearly the same issue, have held that it was appropriate to seal

judicial records that contained information about a private company’s antifraud practices.” See id

(citing Federal Trade Commission v. The Western Union, No. 1:13-mc-00131-AKH (S.D.N.Y.

Mar. 26, 2015) (“Western Union”) and Rinky Dink, Inc. v. Electronic Merchant Systems, No.

C13-1347-JCC, 2015 WL 778065, at *3 (W.D. Wash. Feb. 24, 2015)).

With respect to the documents relating to Defendants’ anti-fraud practices and procedures

for protecting PII (“the Procedure and Practice Documents”), the Court finds that “although

[Defendants] are not law enforcement agenc[ies], [they] have a compelling interest in protecting

the integrity and efficacy of [their] anti-fraud practices” and protecting clients from future data

breaches. Western Union, 1:13-mc-00131-AKH, at ECF No. 76 at 2. “The parties have

adequately explained that public disclosure of [the Procedure and Practice Documents] could

compromise the anti-fraud program by alerting potential offenders to its methodology.” Id; see

also Averbach v. Cairo Amman Bank, No. 19-CV-0004-GHW-KHP, 2023 WL 4144758, at *2

(S.D.N.Y. June 23, 2023) (collecting cases) (“Regardless of the weight that must be accorded to

the presumption [of public access], the court must make specific, on the record findings that

sealing is necessary to preserve higher values . . . includ[ing] personal privacy interests, public

safety, the preservation of attorney-client privilege, and the protection of competitively sensitive

business information.”).

The Court finds here that the parties’ sealing request is “narrowly tailored[,]” as it seeks

to seal only that information that must be sealed to preserve higher values. Susquehanna Int'l

Grp. Ltd. v. Hibernia Express (Ir.) Ltd., 2021 WL 3540221, at *4 (S.D.N.Y. Aug. 11, 2021);

CBF Industria de Gusa S/A v. AMCI Holdings, Inc., No. 13CV2581PKCJLC, 2021 WL

4135007, at *4 (S.D.N.Y. Sept. 10, 2021) (internal citations omitted) (collecting cases)

(“[P]rotecting a company’s IT information fits comfortably within other higher values

consistently recognized by courts in this Circuit, such as the protection of sensitive business

information, the protection of proprietary business information, such as internal analyses,

business strategies, or customer negotiations, and the prevention of potential fraud.”); see also

Kewazinga Corp. v. Microsoft Corp., No. 18-CV-4500 (GHW), 2021 WL 1222122, at *3

(S.D.N.Y. Mar. 31, 2021) (internal quotations omitted) (“Courts commonly find that documents

that contain trade secrets, confidential research and development information, marketing plans,

revenue information, pricing information, and the like satisfy the sealing standard.”); In re Am.

Realty Cap. Properties, Inc. Litig., No. 15-CV-307 (AKH), 2019 WL 11863704, at *1 (S.D.N.Y.

Mar. 25, 2019) (“Screenshots and any other information about ... software that could be used to

copy the program's structure or functions are more deserving of protection.”).

With respect to the documents containing Plaintiff’s or other third-parties’ personal

information (i.e., addresses, phone numbers, etc.), the Court finds this traditionally private

information weighs heavily in the Court’s balancing against the presumption of access, see e.g,

Amodeo, 71 F.3d at 1050–51, and otherwise has no bearing on the lawsuit, and therefore the

public will not be prejudiced if denied access to this information. See Cohen v. Gerson Lehrman

Grp. Inc., No. 09 Civ. 4352 (PKC), 2011 WL 4336679, at *2 (S.D.N.Y. Sept. 15, 2011) (holding

that individual contact information, such as email addresses, home addresses, and phone

numbers, which were not at issue in the litigation, warranted redacted sealing because of the

individual’s “countervailing privacy interest in their non-disclosure”).

CONCLUSION

Accordingly, parties’ Joint Motion to Seal (ECF No. 76) is GRANTED, and the parties

are directed to redact the information at issue in the Procedure and Practice Documents and

Plaintiff’s personal documents, and once redacted, file those documents publicly. The unredacted

copies of the documents may be filed under seal in accordance with this Court’s sealing rules and

procedure. See E.D.N.Y., Steps for E-filing Sealed Documents – Civil Cases (2017),

https://img.nyed.uscourts.gov/files/forms/EfilingSealedCV.pdf.

Dated: Central Islip, New York

February 23, 2024

S O O R D E R E D:

James M. Wicks

/s/

JAMES M. WICKS

United States Magistrate Judge